0

I tried different solutions but none of them work.

I generated a key with ssh-keygen on a machine. I add this key on a linux server in /root/.ssh/authorized_keys, and it works perfectly.

On a second linux server, I did the same. But it doesn't work. I tried different things :

  • Put my key in /root/.ssh/authorized_keys2
  • Edited /etc/ssh/ssh_config and /etc/ssh/sshd_config (by commenting and uncommenting lines)
  • Gave the right rights (700 to .ssh directory and 600 to authorized_keys files)

Nothing seems to work... Still asking me a password.

What could be the problem ?

Thanks a lot.

EDIT :

`sshd_config

Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
#PermitRootLogin without-password
PermitRootLogin no
StrictModes yes
AllowUsers user

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
Ciphers [email protected],[email protected],aes256-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

My ssh -vv result

OpenSSH_6.7p1 Debian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Connecting to IP [IP] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/id_rsa type 1 debug1: key_load_public: No such file or directory debug1: identity file /root/.ssh/id_rsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /root/.ssh/id_dsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /root/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /root/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /root/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /root/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /root/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 Debian-5+deb8u3 debug1: match: OpenSSH_6.7p1 Debian-5+deb8u3 pat OpenSSH* compat 0x04000000 debug2: fd 3 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: [email protected],ssh-ed25519,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,[email protected],zlib debug2: kex_parse_kexinit: none,[email protected],zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-ed25519 debug2: kex_parse_kexinit: [email protected],[email protected],aes256-ctr,aes128-ctr debug2: kex_parse_kexinit: [email protected],[email protected],aes256-ctr,aes128-ctr debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: setup [email protected] debug1: kex: server->client aes128-ctr [email protected] none debug2: mac_setup: setup [email protected] debug1: kex: client->server aes128-ctr [email protected] none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug2: bits set: 1580/3072 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: ED25519 67:fd:fd:6e:a5:c1:32:96:9d:33:32:1a:cf:83:94:ea debug1: Host '[IP]:22' is known and matches the ED25519 host key. debug1: Found key in /root/.ssh/known_hosts:1 debug2: bits set: 1546/3072 debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /root/.ssh/id_rsa (0x7f84b8ce74a0), debug2: key: /root/.ssh/id_dsa ((nil)), debug2: key: /root/.ssh/id_ecdsa ((nil)), debug2: key: /root/.ssh/id_ed25519 ((nil)), debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering RSA public key: /root/.ssh/id_rsa debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,password debug1: Trying private key: /root/.ssh/id_dsa debug1: Trying private key: /root/.ssh/id_ecdsa debug1: Trying private key: /root/.ssh/id_ed25519 debug2: we did not send a packet, disable method user@IP's password:

/var/log/auth.log (on the distant server)

Jul 12 12:24:43 ns3111463 sshd[12971]: input_userauth_request: invalid user root [preauth] Jul 12 12:24:44 ns3111463 sshd[12971]: Connection closed by IP [preauth] Jul 12 12:24:46 ns3111463 sshd[12973]: Connection closed by IP [preauth] Jul 12 12:24:48 ns3111463 sshd[11787]: Received signal 15; terminating. Jul 12 12:24:48 ns3111463 sshd[12977]: Server listening on 0.0.0.0 port 22. Jul 12 12:24:48 ns3111463 sshd[12977]: Server listening on :: port 22. Jul 12 12:24:50 ns3111463 sshd[12978]: Connection closed by IP [preauth] Jul 12 12:24:51 ns3111463 sshd[12980]: User root from IP not allowed because not listed in AllowUsers Jul 12 12:24:51 ns3111463 sshd[12980]: input_userauth_request: invalid user root [preauth] Jul 12 12:24:51 ns3111463 sshd[12980]: Connection closed by IP [preauth] Jul 12 12:25:49 ns3111463 sshd[12977]: Received signal 15; terminating. Jul 12 12:25:49 ns3111463 sshd[13029]: Server listening on 0.0.0.0 port 22. Jul 12 12:25:49 ns3111463 sshd[13029]: Server listening on :: port 22. Jul 12 12:25:50 ns3111463 sshd[13030]: User root from IP not allowed because not listed in AllowUsers Jul 12 12:25:50 ns3111463 sshd[13030]: input_userauth_request: invalid user root [preauth] Jul 12 12:25:51 ns3111463 sshd[13030]: Connection closed by IP [preauth] Jul 12 12:25:53 ns3111463 sshd[13032]: Connection closed by IP [preauth] Jul 12 12:37:41 ns3111463 sshd[13552]: Connection closed by IP [preauth] Jul 12 12:38:09 ns3111463 sshd[13598]: Connection closed by IP [preauth]

8
  • Can you paste sshd_config in your question ?
    – mrc02_kr
    Jul 12, 2017 at 9:40
  • I did it. By the way, I already uncommented AuthorizedKeysFile line, changed the path, etc...
    – Gabriel
    Jul 12, 2017 at 9:44
  • 1
    You have "PermitRootLogin No" in your sshd_config. This might prevent you from logging in as root, as you seem to be trying. (Note that it's almost always a bad idea to turn this on, it's better to use normal users.)
    – marinus
    Jul 12, 2017 at 9:48
  • I commented the line PermitRootLogin no and I uncommented the line PermitRootLogin without-password, I restart ssh service with /etc/init.d/ssh restart but still asking me the password. Do I have to reload something else ? By the way, I accept to connect with my other user called "user" but same error.
    – Gabriel
    Jul 12, 2017 at 9:51
  • 1
    AllowUsers user This will allow only user to log in. Jul 12, 2017 at 11:10

2 Answers 2

1

So you have to be careful since ssh is really picky about the rights when it comes to public key authentication.

You're at least right on the .ssh which should be limited, however that is not all. The /root must also be limited and owned by the user respectivly.

So try adjusting the "home" of the user aswell with 755 so the group cannot write into the home + the right owner of the home is also assigned.

Also why are you using "authorized_keys2" instead of "authorized_keys", I don't think that will work?

5
  • I tried to create the .ssh directory inside my user home too. Look under the previous answer.
    – Gabriel
    Jul 12, 2017 at 10:08
  • show us your ssh connection with -vv
    – Ziazis
    Jul 12, 2017 at 10:11
  • I edited my question. Take a look
    – Gabriel
    Jul 12, 2017 at 10:16
  • 1
    Comment out the "AllowUsers user" or add root to them. + Like the others said uncommenting PermitRootLogin without-password and commenting the PermitRootLogin no
    – Ziazis
    Jul 12, 2017 at 11:18
  • I'm using authorized_keys, just tried with authorized_keys2 because the file was in the .ssh directory.
    – Gabriel
    Jul 12, 2017 at 14:02
1

So you have PermitRootLogin no and authorized_keys file in root home directory. Try to use PermitRootLogin without-password instead. Then restart SSH server:

systemctl restart sshd.service 

For the notice: it's better to forbid root login over SSH even with keys. Create custom user instead, and login to SSH using this user. You can then su to switch to root.

EDIT:

If you want to login as not root, you have to put your public key in the authorized_keys file of your user:

/home/$USER/.ssh/authorized_keys

EDIT2:

To disable authenticating with passwords for all users set PasswordAuthentication no and restart SSH server.

18
  • Okay, I have a custom user called "user". I'm using now PermitRootLogin without-password instead of PermitRootLogin no. I restarted the service but when I'm trying user@myIPadress it still asks me my password.
    – Gabriel
    Jul 12, 2017 at 10:01
  • I edited answer for this. Check it out
    – mrc02_kr
    Jul 12, 2017 at 10:06
  • I created a .ssh inside my "user" home (/home/user/.ssh) directory with permission 700 and I put the authorized_keys and authorized_keys2 inside it with permission 600. Still not working...
    – Gabriel
    Jul 12, 2017 at 10:07
  • Are use using ssh command? You have to specify your key file: ssh user@ip -i $path_to_key. If you want to disable passwords for all users you have to set PasswordAuthentication no
    – mrc02_kr
    Jul 12, 2017 at 10:15
  • I'm simply using ssh user@IP. Worked for some linux servers but not this one.
    – Gabriel
    Jul 12, 2017 at 10:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .